A flaw in Broadcom’s Wi-Fi software development kit can allow nearby attackers to gain root access to some internet gateways, with no CVE or universal fix yet available.
A Belgian security researcher has shown that some internet gateways can be compromised over Wi-Fi without the network password, using a Broadcom software defect that appears to have existed for at least 16 years. Quentin Kaiser disclosed the issue on 16 October at the Hexacon security conference in Paris, where he said the flaw lets an attacker within wireless range run code on affected devices. Reports based on his disclosure say the bug was demonstrated against routers supplied by Belgian internet providers, with no fix in place on the disclosure deadline and no CVE assigned by Broadcom.
The weakness sits in Broadcom’s Wi-Fi software development kit, not in a single brand of router. According to the researcher’s account, the problem affects the Wi-Fi Protected Setup process, which is designed to allow devices to join a network without typing the password. The flawed code mishandles fragmented setup messages, allowing memory corruption that can be turned into remote code execution with root privileges. Several technical write-ups say Broadcom issued only an incomplete patch in 2018 and later advised manufacturers to move to hostapd, a change that is difficult on older hardware and, in some cases, may never be practical.
In his Paris presentation, Kaiser said passive scanning of nearby Wi-Fi networks showed French boxes that appeared to remain unpatched at the time of his survey. Frandroid reported that Orange’s Livebox 5 and SFR’s Box Plus were among the models identified as not corrected in that local snapshot, while other devices seen in the same area were classified as patched. The report also stressed that this was a limited observation in one city, so it should not be read as proof that every unit of those product lines remains exposed.
The practical risk is serious because an attacker who gains control of a gateway can tamper with the local network, change router settings and intercept traffic passing through the device. That does not make encrypted websites readable in plain text, since HTTPS still protects the contents of secure connections, but it does put home computers, phones and connected devices at risk. The attack also does not depend on knowing the Wi-Fi password, which means changing the password alone is not an effective defence.
Kaiser said the bug was easier to uncover with help from advanced AI tools, which he claimed cut the time needed to find and validate the weakness from months to less than a week. He also said the absence of a CVE almost certainly slowed awareness among manufacturers, even though the flaw appears to affect dozens of brands and potentially millions of access points worldwide. For users, the immediate advice is limited: operators generally push updates automatically, disabling WPS may reduce exposure but is not a guaranteed fix, and the only sure workaround is to stop using the Wi-Fi radios altogether and rely on wired Ethernet.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
